Ask HN: How to track SD card theft? | Hacker News Reader

Ask HN: How to track SD card theft?

5 pointsgiantg25 comments

If someone stole an SD from a security cam, is there a way to track it or identify the person, besides using a second hidden camera?

I was thinking of things like a fake card that's a tracker (GPS, network/IP connection, etc), or a card that contains software that can transmit it's location (is that even legal?).

Alternatively, I could replace the camera with something network connected. There's no wifi or ethernet. Cell could be acceptable, but would prefer a more localized type network, like LoRan or something (maybe 500yd range with trees in the way).

View on HN

You could use a Canary / beacon. I have used this before to detect/confirm insider threats in organizations. You could create a PDF with instruction on how to view the data inside the SD. When the attacker opens the document, it would send an alert that the document has been opened.

https://canarytokens.org/generate

This would be an external threat actor. Would this work over the internet?

If the attacker opens the document on a computer connected to the internet, it will.

IIRC, the way it works: the document contains external resources with a unique identifier attached to the campaign, which the document viewer will attempt to connect and fetch. When the document viewer makes the request to retrieve the online resource, it will trigger the alert, collect IP, GEO information, and whatever other data it can collect.

You can use this over the internet, or host internally for internal networks without access to public internet.

Awesome! This sounds great.

I wonder if SD card anti theft could just be built into OSes.

Like, when you mount the card for the first time, Windows could ping a URL and a UUID listed in a file in the card, which could then log your IP.

You could even have an opt out on the OS side, random non-cyber criminals would mostly not do this or even bother learning it exists.

There's a few more minor malicious uses, and a slight risk of cops getting involved for cases that aren't theft though, and I'm sure privacy conscious people would be unhappy about their device sending anything anywhere they didn't specify.

But it sure would make pen testing who picks up random dropped flash drives in parking lots easier.

Maybe an even better way would just be to embed Tile type tracking in the card.

Reply on news.ycombinator.com